Apache Cordova: Failed to load resource: the server responded with a status of 404 (Not Found)

android apache cordova xss

16,598

Solution 1

Removing the whole Android part of the application with:

cordova platform remove android

and adding it again with:

cordova platform add android

solved the problem, which is still a mystery to me.

Perhaps there was something wrong left from the earlier versions of Cordova that wasn't getting on well with the current Cordova version.

Solution 2

I think the problem's with your Content Security Policy meta tag - try adding * to the default-src to open up Ajax requests to anywhere. You could also add a connect-src clause specifically for Ajax requests and list the hosts and protocols you want to be able to access. For example:

<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *; connect-src http://myhost.mydomain.com">

Would allow Ajax requests to http://myhost.mydomain.com

I wrote a blog post addressing this topic that you may find helpful, it can be read here.

Solution 3

Update Android

cordova platform update [email protected]

I had the problem for me connect to a php page on my server and I made an update to android

16,598

Author by

Kaspi

Updated on June 28, 2022

Comments

Kaspi almost 2 years
When I run my application either in the Android emulator or on my Android device, I get he following error on all AJAX requests:
```
Failed to load resource: the server responded with a status of 404 (Not Found)
```
I have tried all the following steps to solve this problem, but it persists.
- Installed the whitelist plugin to the project using npm.
- Added <plugin name="cordova-plugin-whitelist" version="1" /> to config.xml.
- Added <uses-permission android:name="android.permission.INTERNET" /> to platforms\android\AndroidManifest.xml.
- Added <meta http-equiv="Content-Security-Policy" content="default-src * 'unsafe-inline';"> and <meta http-equiv="X-XSS-Protection" content="0"> to the <head> of www/index.html file.
- Added <access origin="*" />, <allow-navigation href="*" /> and <allow-intent href="*" /> to the config.xml file.
Regardless I still get the same errors. Any ideas?

The project compiles fine. I'm on Windows 7, using Cordova 5.4.0, Android 5.1.1
Kaspi over 8 years

I am very sorry, but I accidentally deleted the * wildcard from my Content-Security-Policy tag, it's included in fact and I edited my question. So this doesn't solve the problem. I tried your Content-Security-Policy meta to restrict requests to only one domain name and I still get: 404 (Not Found) But, for the other domains that are actually not allowed by Content-Security-Policy now, I get: Refused to load the script because it violates the following Content Security Policy... So probably the 404 error is caused by something else than Content-Security-Policy. How to investigate more?
Simon Prickett over 8 years

I would try using the Chrome remote debugger tools and looking for any JavaScript console errors, and what happens on the network tab when you try your Ajax call. That may shed more light on the problem.
w3spi about 5 years

This doesn't work with cordova 8.1.2 and having same issue on AVD Android 8.0
Ualter Jr. almost 5 years

Unfortunately, this is not the root cause, doesn't work in all cases.